[ Tuesday, September 06, 2022 ]
Chapter 11: Documenting HIPAA:
the Notice of Privacy Practices
This is a continuation of my series of 20 posts celebrating the 20th anniversary of the HIPAA Privacy Rule and the 20th anniversary of the beginning of this blog.
As discussed above, the first and greatest (the “paladium,”
if you will) right granted (or
recognized as belonging) to individuals under HIPAA is the right to know the
“rules of the road.” Prior to HIPAA,
most healthcare providers required patients to sign a consent document, upon
becoming a patient, that clearly gave the patient’s consent to the provider
using and disclosing the patient’s information to the patient’s insurer, for
example. Providers knew (i) they were
subject to patient confidentiality requirements (either statutory or common
law), (ii) they’d be using the information that way, and (iii) it was easy
enough to do at patient onboarding. As
originally drafted in the Clinton Administration, HIPAA also required covered
entities to obtain a specific consent from patients prior even for uses such as
treatment, payment, and healthcare operations (TPO).
The Bush Administration removed the consent requirement,
since it was unwieldy: a specialist physician would not even be able to look at
the medical records of a patient referred to him for a consult until the
patient arrived and signed a consent; a pharmacy would not be able to pre-fill
your prescription until you showed up and signed a form. This would result in unnecessary delays to
patient care. The fix would be to allow
the expected and otherwise permitted types of disclosures without specific
consent, as long as the covered entity properly disclosed the general types of
uses that were to be expected. Thus,
HIPAA allows covered entities to use and disclose PHI without the authorization
or consent of the patient for PTO, as required by law, or for certain other
purposes; however, the covered entity must provide the patient, upon first
contact, with a document outlining what those permitted uses and disclosures
are, and which ones the covered entity is going to be engaging in. It’s only fair: we remove the burden of pre-consent
for those standard “ordinary course of business” uses and disclosures, but add
the burden of fair disclosure when it becomes feasible.
The Notice of Privacy Practices (sometimes referred to as
the NPP, although I prefer NoPP – adds one letter when you’re writing it, but
eliminates 2 syllables when you’re saying it) has 3 main required elements, the
first being a discussion of the types of uses and disclosures to be
expected. This fulfills the “fair warning”
of the “rules of the road” concept inherent in the Bush Administration’s
removal of the consent requirement. In
order to meet the requirements, the NoPP should provide a list of each general
type of expected use and disclosure, with a more detailed description or
example of the major types. For example,
legally-required disclosures for law enforcement or public health purposes
could be described in just so many words, but treatment or payment disclosures
should include an example.
The second required element is a description of the
individual’s rights with respect to their information. There is a “fair notice” element at play
here, but it as much serves as a governor on covered entities that might
otherwise want to run roughshod over their patients, by forcing them to
acknowledge what they must do for their patients, and arming the patients with
that information.
As noted above, the right to receive the NoPP is the first
right of individuals, but there are 5 others: the right to access your PHI, the
right to request amendments, the right to an accounting of disclosures, the
right to request communications in a different format or at a chosen location,
and the right to request specific privacy protections. These rights must be discussed in the NoPP.
Finally, the NoPP must provide a description of how a
patient can file a complaint and seek his/her PHI. The complaint instructions should include a
description of how to complain to the provider itself, as well as how to skip
straight to the enforcement agency and file a complaint with the Office for
Civil Rights.
The NoPP must also be written in plain language, and must be
available in other languages if the covered entity has a large enough
population of non-English speakers.
Given the amount of information that must be conveyed (for example, if a
covered entity does not specifically include a particular permitted use or
disclosure in the NoPP, it cannot so use or disclose the patient’s PHI without
an authorization), there is pressure to make the NoPP as long and legalistic as
possible. The plain language requirement
is intended to prevent this. These
competing goals of generality and granularity means that covered entities must
seek the “Goldilocks” level of sophistication and earthiness for their NoPPs;
good luck with that.
Currently, the covered entity must attempt to obtain a
“receipt” signature of the individual upon delivery of the NoPP; if the
individual cannot or refuses to sign, the covered entity should simply note the
failure or refusal, but cannot condition care or services upon receipt of the
signature. So why go to the
trouble? Conceptually, this requirement
is a sort of “good faith” enhancer to (i) ensure the covered entity delivers
the NoPP and (ii) ensure the patient/beneficiary understands the importance of
the NoPP and the need to review (or at least understand) the information in it
(most people pay more attention to the contents of a document they must sign
than they do to one simply handed to them).
Recent proposed revisions to the HIPAA regulations have indicated that
the signature requirement may go away, but hold your tickets, that might not
make it through to the final rules.
Jeff [11:48 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
